diff --git a/README.md b/README.md
index bea47af..b427c82 100644
--- a/README.md
+++ b/README.md
@@ -251,9 +251,12 @@ scans both the working tree and the committed history on every push and a hit
 fails the build. Trivy scans the release configuration and the built images for
 HIGH and CRITICAL findings.
 
-The `nereus-db` Secret holds the PostgreSQL password and the DSN, and it is
-created out of band rather than living in `base/kustomization.yaml`. See
-`deploy/secrets/README.md` for how it is created in each environment.
+The `nereus-db` Secret holds the PostgreSQL password and DSN. Production gets
+it from the encrypted `deploy/secrets/nereus-db-sealed.yaml`; the Sealed Secrets
+controller is the only component that can decrypt it. The current Fedora
+cluster was reset onto a fresh PVC and verified with that committed resource.
+Development can still create an ephemeral Secret directly. See
+`deploy/secrets/README.md` for both workflows.
 
 The CI pipeline never uses a cluster-admin kubeconfig. It authenticates as a
 `deployer` ServiceAccount with RBAC scoped to the `nereus` namespace, supplied
@@ -325,10 +328,10 @@ pre-promotion analysis fails the pipeline.
 | Docker Compose | `compose.yaml`, plus `observability/compose.yaml` and `build/compose.mini.yaml` |
 | Kubernetes orchestration | k3s, two Fedora 44 nodes; k3d for a portable equivalent |
 | Deployments, Services, Ingress, ConfigMaps, Secrets | `deploy/base/`, composed with kustomize overlays |
-| Infrastructure as code | `scripts/provision/`, Ansible roles plus an idempotent bootstrap |
+| Infrastructure as code | `terraform/infra/` for libvirt machines, `terraform/platform/` for cluster controllers, and `scripts/provision/` for host configuration |
 | CI/CD pipeline | `.forgejo/workflows/pipeline.yml`, self-hosted runner |
 | Container registry | Forgejo registry at `git.fiwlabs.dev`, TLS from Traefik |
-| Secure credential handling | Gitleaks, Trivy, namespace-scoped `deployer` kubeconfig, out-of-band `nereus-db` |
+| Secure credential handling | Gitleaks, Trivy, namespace-scoped `deployer` kubeconfig, and a committed encrypted `nereus-db` SealedSecret |
 | Blue-green deployment | Argo Rollouts, `deploy/rollouts/rollout.yaml` |
 | Automated rollback | `deploy/rollouts/analysistemplate.yaml`, Prometheus-driven abort |
 | OpenTelemetry Collector | `deploy/observability/otel-collector.yaml` for traces, `otel-log-collector.yaml` for logs |
@@ -342,21 +345,14 @@ pre-promotion analysis fails the pipeline.
 
 Stated plainly so it does not have to be discovered.
 
-`terraform/infra/` creates the two Fedora 44 libvirt machines and emits the
-inventory consumed by Ansible. `terraform/platform/` installs Argo Rollouts,
-Sealed Secrets and kube-prometheus-stack. The separation is deliberate:
-Terraform owns machines and cluster-wide controllers, Ansible owns the hosts,
-and Kustomize owns the application.
-
-Sealed Secrets and Discord alert routing are configured. The database
-`SealedSecret` is committed for fresh deployments; the Discord resource still
-awaits its owner-provided webhook. `deploy/secrets/README.md` keeps plaintext
-values in local pipelines and commits only encrypted resources. The controller
-key must be backed up outside this repository before it becomes the recovery
-path.
+Discord routing is configured but disabled until an owner-provided webhook is
+sealed. The Sealed Secrets controller key also needs an off-repository backup;
+without it, a rebuilt cluster cannot decrypt the committed database resource.
 
 The remaining acceptance gap is environmental: the reproducible fresh-VM path
 has not been rerun on a second workstation with no dependencies installed.
+After final sign-off, the local QEMU lab and packages installed only for it can
+be removed.
 
 ## Fedora traps worth knowing